Security Hardening

Security hardening is the ongoing practice of reducing a system's attack surface: fewer open doors, tighter permissions, faster patching, and a written policy that says what "secure enough" actually means for your organization. See Cybersecurity in the CSE fundamentals track for what cybersecurity is and why it matters; this page is about applying it operationally.

Core Concepts

A handful of properties show up in almost every security discussion — memorize these, and most security policy reads as a specific way of protecting one or more of them:

  • Confidentiality — only authorized users can view or modify sensitive data.
  • Integrity — data stays accurate and complete, and any tampering is detectable.
  • Availability — authorized users can reach the data when they need it.
  • Authentication — verifying who (or what) is making a request.
  • Authorization — granting each authenticated identity exactly the access it needs, and no more — the principle of least privilege.
  • Risk management — identifying, assessing, and mitigating risk on an ongoing basis, not once.
  • Incident response — a rehearsed plan for responding to and recovering from a security incident.
  • Continuous monitoring — watching systems and networks for signs of attack in real time, not just at audit time.

Writing a Security Policy

A security policy is a set of rules and procedures that protects an organization's systems, networks, and data from unauthorized access, use, disclosure, disruption, modification, or destruction. A solid policy is tailored to the organization, but it typically covers:

  • Data classification — sensitivity levels that determine how much protection each category of data needs.
  • Access control — restricting data access to authorized users, via passwords, certificates, or other authentication.
  • Data encryption — protecting sensitive data in transit and at rest.
  • Patch management — a cadence for patching software and operating systems against known vulnerabilities.
  • User training — strong passwords, phishing awareness, and how to report suspicious activity.
  • Incident response plan — the concrete steps to contain, investigate, and recover from an incident.

A few things keep a policy from going stale:

  • Review and update it regularly as risks and requirements change;
  • Communicate it to every employee, and back it with training and consequences;
  • Integrate it with risk assessment, incident response, and disaster recovery — it shouldn't stand alone;
  • Have legal counsel confirm it meets every applicable law and regulation.

GDPR Basics

The General Data Protection Regulation (GDPR) is EU law governing data protection and privacy for individuals in the EU and EEA. It aims to give people control over their own personal data, and to simplify the regulatory landscape for businesses operating across the EU by unifying the rules.

For any organization processing personal data of EU individuals, GDPR requires:

  • Obtaining consent before collecting or processing personal data;
  • Giving individuals access to their data, and the right to have it erased;
  • Protecting personal data from unauthorized access, use, or disclosure;
  • Notifying individuals of data breaches;
  • Appointing a Data Protection Officer (DPO) in certain cases.

Non-compliance carries real teeth: fines up to €20 million or 4% of global annual turnover, whichever is greater. Getting compliant generally means reviewing your privacy policies and procedures, implementing the technical and organizational measures above, and appointing a DPO where required.

Further reading: the official GDPR reference site, and the UK ICO's guide to the GDPR.

Other Resources

  • Coursera — free cybersecurity specializations covering specific areas in depth.
  • edX — free introductory and specialized cybersecurity courses.
  • SANS Cyber Aces — a free program teaching the core skills to start a cybersecurity career.
  • CISA (US-CERT) — free resources for learning cybersecurity and protecting yourself online.